headers
sftf | 1 Mar 2006 05:34
Picon
Favicon

RC FD (and other types) :DEFAULT: ?

Hi!
  In ACL model we have defaults (:DEFAULT:) for all object types.

  Whether there is an analogue of the ACL's :DEFAULT: in RC model and
  where it is?

  I see that the FD root(/) has inherits type, but from what?
  Or these default RC types are builtin to kernel?
Thanks!
--

-- 
Best regards,
 sftf                          mailto:sftf <at> yandex.ru
Permalink | Reply | 1 comment |
headers
sftf | 1 Mar 2006 05:53
Picon
Favicon

how to reset attributes to defaults at each module separately (per module, not per object type)?

Hi!
  In menus I see "Reset Attributes" (attr_rm_...).
  As I have understood, it allows to reset attributes on per object bases.
  But how to reset attributes of all types in scope of one model?
Thanks!
--

-- 
Best regards,
 sftf                          mailto:sftf <at> yandex.ru
Permalink | Reply | 10 comments |
headers
Amon Ott | 2 Mar 2006 08:32

Re: RC FD (and other types) :DEFAULT: ?

On Mittwoch 01 März 2006 05:34, sftf <at> yandex.ru wrote:
>   In ACL model we have defaults (:DEFAULT:) for all object types.
> 
>   Whether there is an analogue of the ACL's :DEFAULT: in RC model 
and
>   where it is?
> 
>   I see that the FD root(/) has inherits type, but from what?
>   Or these default RC types are builtin to kernel?

If there is no parent, the default is hardcoded to 0 in all cases. 
This is part of the RC specification.

Amon.
--

-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
Permalink | Reply | 0 comments |
headers
Amon Ott | 2 Mar 2006 08:33

Re: how to reset attributes to defaults at each module separately (per module, not per object type)?

On Mittwoch 01 März 2006 05:53, sftf <at> yandex.ru wrote:
>   In menus I see "Reset Attributes" (attr_rm_...).
>   As I have understood, it allows to reset attributes on per object 
bases.
>   But how to reset attributes of all types in scope of one model?

This can only be done by hand so far - noone ever wrote a tool to do 
it. A simple script could do that.

Amon.
--

-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
Permalink | Reply | 0 comments |
headers
Amon Ott | 7 Mar 2006 10:07

RSBAC Meeting point at Cebit 2006

Hello everybody,

just wanted to remind you that during Cebit 2006 from 9th to 15th of 
March in Hannover, Germany, there will be an RSBAC meeting point at 
m-privacy GmbH in Hall 7, Booth D22/12e.

We would be glad to meet many of you there!

Amon.
--

-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22
Permalink | Reply | 0 comments |
headers
kang | 7 Mar 2006 11:00

RSBAC 1.2.6pre4 released


1.2.6pre4 released

RSBAC 1.2.6pre4 has been released for both kernels 2.4.32 and 2.6.15.
This should be a
short preview release before the 1.2.6 release. Please test it and
send us reports !

Changes since pre3:

    * New kthread notification code
    * New dazuko code from dazuko 2.2
    * Caches infected results on read/open/close instead of rescan
    * Fix xstats to include GROUP targets
    * Mark lists dirty again, if saving failed
    * Debian packaging fixes

Patches and prepatched kernels are available at this location:

https://rsbac.org/dl.php?file=pre/rsbac-1.2.6pre4/
Permalink | Reply | 2 comments |
headers
sftf | 8 Mar 2006 14:37
Picon
Favicon

ROLE (System Boot) and MODIFY_ATTRIBUTE problems

Hi!
In a init script mountfs I've added commands for setup proc virtual filesystem access:

acl_grant ROLE 999999 RW FD /proc
acl_grant ROLE 10 RW FD /proc/kmsg

where 999999 == System Boot ROLE and 10 == ROLE for syslog-ng.
This script executed with System Boot ROLE.

All works as well as it was supposed with this but...
ROLE System Boot has no MODIFY_ATTRIBUTE on General_FD type!
And nevertheless this script changes RSBAC ACL attributes somehow...
Even "clean" (with no rsbac.dat) system allows a System Boot role
to change these RSBAC attributes.

I think that without MODIFY_ATTRIBUTE, role should not have an
ability to change any RSBAC attributes.

System:
linux 2.6.15.1, RSBAC 1.3.0pre1,
system has no ROLE with MODIFY_ATTRIBUTE except Role_Admin,
all files has General_FD type,
ACL FD :DEFAULT: for USER_0 (root) has no MODIFY_ATTRIBUTE,
ACL FD :DEFAULT: has no entry for ROLE_999999 (System Boot).
Active modules: UM,ACL,RC,CAP.

Thanks a lot!
--

-- 
Best regards,
 sftf                          mailto:sftf <at> yandex.ru
(Continue reading)

Permalink | Reply | 0 comments |
headers
sftf | 9 Mar 2006 13:10
Picon
Favicon

ACL FD rights inheritance

Hi!
Example:
/usr has MOUNT UMOUNT rights for ROLE 999999 and MOUNT UMOUNT mask set.
Effective rights for /usr/bin (/usr/...): MOUNT UMOUNT - inheritance work.

Then I grant READ to ROLE 999999 for /usr/bin.
Now effective rights for /usr/bin: READ (not MOUNT + UMOUNT + READ) - inheritance don't work.
It is correct?
I.e. dir rights don't summarized with parent dir rights?

Thanks!
--

-- 
Best regards,
 sftf                          mailto:sftf <at> yandex.ru
Permalink | Reply | 1 comment |
headers
Amon Ott | 9 Mar 2006 16:57
Picon

Re: ACL FD rights inheritance

sftf <at> yandex.ru writes: 

> Example:
> /usr has MOUNT UMOUNT rights for ROLE 999999 and MOUNT UMOUNT mask set.
> Effective rights for /usr/bin (/usr/...): MOUNT UMOUNT - inheritance work. 
> 
> Then I grant READ to ROLE 999999 for /usr/bin.
> Now effective rights for /usr/bin: READ (not MOUNT + UMOUNT + READ) - inheritance don't work.
> It is correct?
> I.e. dir rights don't summarized with parent dir rights?

If you have an ACL entry for a subject, inheritance is not used. 

Amon Ott
RSBAC
Permalink | Reply | 0 comments |
headers
Trinh Anh Tuan | 13 Mar 2006 11:29
Picon

RSBAC & Hard disk encryption

Hi all,

Does any one try to implement RSBAC with some kind HDD encryption like 
ncryptfs or any other? I would like to integrate a HDD encryption engine 
along with RSBAC on my linux box and need information on it.

Thanks,
TAT
Permalink | Reply | 1 comment |

Gmane